Updated October 2026

Cybercrime is no longer a problem affecting only large corporations or people who are unfamiliar with technology.

Individuals, families and small businesses are increasingly exposed to sophisticated online scams, fraudulent emails, stolen passwords and attacks on their computer systems.

A convincing email from someone you know, an unexpected request to change banking information or a fraudulent text message can lead to significant financial losses.

Cybercriminals have also become better at impersonating legitimate organizations and individuals. Some attacks use stolen email accounts, realistic websites and artificial intelligence to make fraudulent communications more convincing.

Understanding how these scams work is an important first step in protecting yourself.

At L.D. Dermody Insurance Brokers, we believe cyber awareness should be part of the conversation about protecting your personal finances, property and business.

1. What Is Cybercrime?

Cybercrime refers to criminal activities involving computers, electronic devices, networks or online services.

Some cybercriminals attempt to steal money directly. Others seek personal information, passwords, financial records or access to computer systems.

Common forms of cybercrime include:

• Phishing emails and fraudulent text messages.

• Hacked email and social media accounts.

• Ransomware attacks.

• Identity theft.

• Online banking and payment fraud.

• Fraudulent invoices.

• Business email compromise.

• Data breaches.

• Online shopping and investment scams.

These incidents can affect anyone who uses email, online banking, social media or internet-connected devices.

Businesses may face additional risks because they handle customer information, process payments and rely on computer systems to operate.

2. Phishing: When an Email Isn't What It Appears to Be

Phishing is one of the most common methods cybercriminals use to obtain sensitive information.

A phishing email may appear to come from:

• Your bank.

• A delivery company.

• A government agency.

• Microsoft or another technology provider.

• An insurance company.

• A friend, family member or business contact.

The message may claim that your account has been suspended, a payment has failed or an urgent security issue requires your attention.

It may ask you to click a link, open an attachment or enter your password.

The link may lead to a fraudulent website designed to look almost identical to a legitimate sign-in page.

If you enter your credentials, the criminal may be able to access your account.

What Makes Phishing Difficult to Recognize?

Phishing messages are not always filled with spelling mistakes or obvious warning signs.

Modern scams can use professional formatting, familiar logos and convincing language.

A fraudulent email may even come from a legitimate account that has been compromised.

Do not assume an email is safe simply because you recognize the sender's name or address.

If a message is unexpected or requests sensitive information, verify it through a separate, trusted method.

For example, contact the person using a telephone number you already know rather than replying to the suspicious email.

3. What Happens When an Email Account Is Hacked?

An email account can contain a surprising amount of valuable information.

Depending on how it is used, criminals who gain access may be able to:

• Read personal or business correspondence.

• Access stored contact information.

• Send fraudulent messages to other people.

• Search for invoices and payment details.

• Attempt to reset passwords for other accounts.

• Create forwarding rules to receive future emails.

• Impersonate the account owner.

A hacked email account can also be used to target other people.

For example, a criminal may send a fraudulent payment request from an account belonging to someone the recipient knows and trusts.

What Should You Do if Your Email Account Is Compromised?

If you believe someone has accessed your account:

1. Use the provider's official account recovery process.

2. Change your password using a trusted device.

3. Review and remove unfamiliar sign-in sessions, recovery methods, connected applications and email forwarding rules.

4. Enable multifactor authentication.

5. Check other accounts that may use the same password.

6. Warn affected contacts if fraudulent messages were sent.

7. Review financial accounts for suspicious activity.

If the account is used for business, notify the person responsible for your organization's technology and security.

A compromised business account may require a more extensive investigation.

4. Business Email Compromise: A Serious Risk for Small Businesses

Business email compromise occurs when criminals impersonate a business contact or gain access to a legitimate email account to facilitate fraud.

One common example involves changing payment instructions.

Imagine that a small business receives an invoice from a regular supplier.

Shortly afterward, another email arrives advising that the supplier has changed banks and future payments should be sent to a different account.

The message appears genuine, and the business transfers the money.

Later, the supplier advises that payment was never received.

The email requesting the banking change was fraudulent.

These scams can also involve:

• Fake requests from company owners or managers.

• Fraudulent payroll deposit changes.

• Impersonation of lawyers or real estate professionals.

• False requests for urgent wire transfers.

• Altered invoices.

How Can Businesses Reduce This Risk?

Establish a procedure requiring independent verification of changes to payment instructions.

For example, if a supplier emails new banking information, telephone the supplier using a previously verified number.

Do not rely on a telephone number included in the suspicious email.

Businesses should also consider requiring additional approval for larger or unusual payments.

A simple verification phone call can prevent a substantial financial loss.

5. Ransomware: When Criminals Lock Your Files

Ransomware is malicious software that can encrypt files or disrupt access to computer systems.

Criminals then demand payment, often in exchange for a promise to restore access.

Some attackers also steal sensitive information and threaten to release it.

For a small business, a ransomware attack could prevent access to:

• Customer records.

• Accounting systems.

• Appointment schedules.

• Business email.

• Inventory information.

• Operational software.

Even if the business has backups, restoring systems can take time and require specialized assistance.

Ransomware incidents may also create privacy and legal obligations if personal information has been compromised.

Paying a ransom does not guarantee that systems will be restored or stolen information will remain confidential.

Businesses should obtain qualified incident response advice rather than attempting to resolve a serious ransomware incident on their own.

6. Identity Theft and Personal Information

Identity theft occurs when someone uses another person's identifying information without authorization.

Criminals may attempt to use stolen information to:

• Apply for credit.

• Open accounts.

• Make unauthorized purchases.

• Access existing financial accounts.

• Impersonate someone in other transactions.

Personal information may be obtained through phishing, data breaches, stolen documents or compromised accounts.

To reduce your exposure, use strong account security, monitor financial statements and be cautious about sharing sensitive information.

If you suspect identity theft, contact affected financial institutions promptly and consider contacting Canada's major credit reporting agencies, Equifax and TransUnion, about appropriate fraud protections.

7. Online Shopping, Investment and Romance Scams

Not every cybercrime involves hacking.

Some criminals rely on deception rather than gaining unauthorized access to computer systems.

Online shopping scams may involve fake retailers, counterfeit listings or products that are never delivered.

Investment scams may promise unusually high returns or pressure people to act quickly.

Romance scams involve building a relationship online before requesting money, gifts or financial assistance.

These scams can be emotionally and financially devastating.

Warning signs may include:

• Requests for secrecy.

• Pressure to send money immediately.

• Demands for payment through cryptocurrency, gift cards or unusual methods.

• Refusal to communicate through normal channels.

• Promises of guaranteed investment returns.

• Repeated emergencies requiring financial assistance.

If something seems suspicious, stop the transaction and independently verify the circumstances before sending money.

8. How Artificial Intelligence Is Changing Online Scams

Artificial intelligence can make fraudulent communications more convincing.

Cybercriminals may use AI tools to create realistic emails, imitate writing styles or produce convincing audio and video impersonations.

For example, someone might receive a telephone call that sounds like a family member urgently requesting money.

A business employee might receive a message that appears to come from a manager authorizing an unusual payment.

The fact that a message sounds or looks authentic is no longer sufficient proof that it is genuine.

Families and businesses can reduce this risk by establishing verification procedures.

For example, agree to confirm unusual financial requests through a known telephone number or another independent communication method.

9. Does Home Insurance Cover Cybercrime?

Some homeowners, condominium and tenants insurance policies may include limited protection for certain identity theft or cyber-related expenses.

Other insurers may offer optional endorsements providing broader personal cyber coverage.

Depending on the insurer and wording, coverage might address certain expenses associated with:

• Identity restoration.

• Cyberbullying or online harassment.

• Cyber extortion.

• Data recovery.

• Certain online fraud losses.

However, coverage varies considerably.

A standard home insurance policy should not be assumed to cover money lost to phishing scams, fraudulent investments, unauthorized transfers or other online fraud.

Even where personal cyber insurance is available, there may be exclusions, sublimits, deductibles and specific reporting requirements.

If you are concerned about personal cyber exposures, ask your broker what coverage options are available through your insurer.

10. What Is Commercial Cyber Insurance?

Commercial cyber insurance is designed to address certain financial consequences of covered cyber incidents affecting a business.

Depending on the policy, coverage may include:

Incident Response Expenses

Access to specialists who can assist with investigating and responding to a cyberattack.

Computer System Restoration

Certain costs associated with restoring damaged or compromised systems and data.

Cyber Business Interruption

Coverage for specified lost income and additional expenses when a covered cyber event disrupts operations.

Privacy and Data Breach Expenses

Certain legal, notification and response costs arising from a covered privacy or security incident.

Cyber Liability

Protection against certain third-party claims arising from covered privacy or network security incidents.

Cyber Extortion

Certain expenses associated with covered cyber extortion incidents, subject to policy conditions.

Not every policy includes all of these protections.

Insurers may offer different limits, deductibles, waiting periods, exclusions and optional endorsements.

11. Does Cyber Insurance Cover Fraudulent Money Transfers?

This is one of the most important questions to ask when reviewing cyber insurance.

A business might suffer a cyberattack that disrupts its computer systems.

Alternatively, an employee might voluntarily transfer money to a criminal after receiving fraudulent payment instructions.

Although both incidents involve cybercrime, insurance policies may treat them very differently.

Some cyber policies offer specific coverage for social engineering fraud, funds transfer fraud or related financial losses.

Other policies exclude these losses or provide only limited coverage.

Commercial crime insurance may also address certain fraud exposures, depending on the policy.

Do not assume that purchasing cyber insurance automatically protects your business against every type of financial fraud.

Ask your broker to explain whether fraudulent payment instructions, social engineering and unauthorized transfers are covered, and under what conditions.

12. Cyber Insurance Does Not Replace Cybersecurity

Insurance can help address certain financial consequences of a cyber incident, but preventing an attack remains essential.

Insurers may also require businesses to maintain particular security controls.

These can include:

• Multifactor authentication.

• Regular data backups.

• Antivirus and endpoint protection.

• Software updates.

• Employee security training.

• Restricted administrative access.

• Appropriate payment verification procedures.

Some cyber insurance applications ask detailed questions about these measures.

It is important to answer accurately.

A business should not state that multifactor authentication is enabled throughout its systems if it is only used on some accounts.

Inaccurate or incomplete information can create serious issues when an insurer reviews a claim.

13. Ten Practical Ways to Reduce Your Cyber Risk

There are several steps individuals and businesses can take to improve online security.

1. Use unique passwords

Avoid reusing the same password across multiple accounts. Consider using a reputable password manager.

2. Enable multifactor authentication

Use multifactor authentication wherever available, particularly for email, banking and business systems.

3. Keep software updated

Install security updates for computers, phones, browsers and other connected devices.

4. Be cautious with unexpected links

Instead of clicking an unfamiliar link, access the organization through its official website or application.

5. Verify unusual payment requests

Confirm changes to banking information or requests for urgent payments through a trusted, independent channel.

6. Back up important data

Maintain regular backups and ensure they are protected from the same incident that could affect your primary systems.

7. Limit access to sensitive information

Employees should have access only to the systems and information necessary for their work.

8. Train employees

Provide practical training on phishing, password security, suspicious attachments and payment fraud.

9. Monitor accounts

Review banking activity, credit card transactions and account notifications for unusual activity.

10. Have a response plan

Know whom to contact if an account is compromised, money is transferred fraudulently or business systems are attacked.

Even basic precautions can make a meaningful difference.

14. What Should You Do if You Become a Victim of Cybercrime?

The appropriate response depends on the incident, but acting quickly is important.

If Money Has Been Stolen

Contact your bank or financial institution immediately.

Explain what happened and ask whether the transaction can be stopped, recalled or investigated.

Recovery is not guaranteed, but delays may reduce the available options.

If an Account Has Been Compromised

Use the provider's official recovery and security procedures.

Change passwords, review account settings and secure related accounts.

If Your Business Has Experienced a Cyberattack

Contact your technology or cybersecurity provider.

If you have cyber insurance, notify your insurance broker or insurer promptly.

Some cyber policies provide access to approved incident response specialists and require insurer involvement before certain expenses are incurred.

Avoid making major decisions about system restoration, ransom demands or outside service providers without appropriate professional advice.

Report the Incident

Cybercrime and fraud can be reported to the Canadian Anti-Fraud Centre.

You may also need to contact your local police service.

Depending on the incident, businesses may have additional privacy breach notification obligations under applicable law.

15. Why Small Businesses Should Take Cybercrime Seriously

Some business owners believe cyber insurance is only necessary for companies that store large amounts of sensitive information.

However, even a small business can rely heavily on email, electronic payments, cloud software and customer records.

Consider a contractor who receives fraudulent banking instructions, a retailer whose point-of-sale system is compromised or a professional office that loses access to its client files.

A serious incident could result in:

• Lost income.

• System restoration costs.

• Fraud-related financial losses.

• Professional fees.

• Reputational damage.

• Disruption to customers.

• Potential legal or regulatory obligations.

The financial consequences can be substantial even for a business with only a few employees.

Cyber insurance may be an important part of a broader risk management strategy, but the policy should reflect the business's actual exposures.

For more information about commercial insurance, see our article What Insurance Do Ontario Small Businesses Actually Need?

Protecting Yourself in an Increasingly Digital World

Cybercriminals continually adapt their methods.

A fraudulent message may look legitimate, a caller may sound familiar and an online payment request may appear to come from a trusted business contact.

The best protection involves a combination of awareness, good security practices, verification procedures and appropriate insurance.

For individuals, this means protecting accounts, monitoring financial activity and being cautious about unexpected requests.

For businesses, it also means training employees, maintaining cybersecurity controls and understanding the financial risks associated with a cyber incident.

At L.D. Dermody Insurance Brokers, we can help clients review the personal and commercial cyber insurance options available through the companies we represent.

If you have questions about cyber insurance or would like to discuss how your existing policies respond to cyber-related losses, contact L.D. Dermody Insurance Brokers. We would be pleased to help you review your coverage options.

This article provides general information about cybercrime and insurance in Ontario as of October 2026. Insurance coverage depends on the terms, conditions, exclusions, limits and endorsements of the applicable policy. Cybersecurity, privacy and incident response obligations vary according to the circumstances and applicable law.